An iptables ACCEPT rule does not create a listening service or guarantee that packets reach that rule. A port remains unreachable when no process is listening, the service is bound to the wrong address family or interface, traffic enters a different chain or network namespace, another firewall drops it, or the reply takes the wrong route. Troubleshoot in that order: verify the socket, test locally and remotely, identify IPv4 versus IPv6, inspect every active ruleset and counter, then validate routing and persistence.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start with the socket, not the firewall
The kernel can accept a packet only if an application has opened the destination port. Check TCP and UDP listeners with:
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ss -lntup
ss -lnupIn the ss output, -l shows listening sockets, -t selects TCP, -u selects UDP, and -n leaves addresses and ports numeric. Confirm all of the following:
- The expected port number is present.
- The protocol matches the client: TCP and UDP are separate services and rules.
- The process is in
LISTENstate for TCP, or has an open UDP socket. - The bind address includes the address clients are using.
A listener on 127.0.0.1:8080 accepts only local loopback connections. A listener on one private address will not answer a different interface address. A service showing only an IPv4 socket will not necessarily answer an IPv6 connection, and an IPv6-only socket may not answer IPv4 clients. Inspect the service configuration and logs if the socket is missing or has an unexpected bind address.
#1 Best Overall
Test the same endpoint locally and remotely
Use the exact address family and port shown by ss. For an HTTP service, for example:
curl -v http://127.0.0.1:8080/
curl -v http://SERVER_ADDRESS:8080/For a non-HTTP TCP service, use a TCP client such as nc:
nc -vz SERVER_ADDRESS PORTRun the first test on the server itself, then run the remote test from a different host on the intended network. A local success and remote failure narrows the fault to the bind address, routing, host filtering, an upstream firewall or ACL, NAT, or the return path. A local failure means the remote network is not yet relevant: fix the service, its bind setting, or the local address first.
Do not test a name and assume it maps to one address. Resolve the name and note whether the client selected an A record (IPv4) or an AAAA record (IPv6). Test each address explicitly when diagnosing a dual-stack service.
Check IPv4 and IPv6 independently
iptables and ip6tables are separate rule tools. A rule in the IPv4 ruleset does not open the corresponding IPv6 port. Compare the listener and rules for both families:
ss -lntup
iptables -S
ip6tables -SIf a client prefers IPv6, an AAAA address can make a service appear closed even though IPv4 testing succeeds. Conversely, an IPv6 listener or rule does not repair an IPv4 path. Use explicit tests such as curl -4 and curl -6 where the application supports them, and examine both the bind address and the firewall policy for the family that actually carries the failed connection.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchInspect the effective configuration, not just the command you typed
The command that added a rule may not describe the rules currently evaluating packets. Dump each relevant control plane:
iptables -S
iptables -t nat -S
ip6tables -S
nft list rulesetThe first two commands show the IPv4 filter and NAT tables in a readable rule specification. ip6tables -S shows the IPv6 rules. nft list ruleset displays the active nftables configuration, including rules created by a service manager. Modern distributions increasingly use nftables as the packet-filtering framework; an iptables command may be a compatibility interface rather than the only ruleset in effect.
Look for the rule’s actual chain, protocol, destination port, destination address, input interface and source restrictions. A rule that permits TCP destination port 443 does not permit UDP 443. A rule matching interface eth0 does not match traffic arriving on a bridge such as br0. A destination-address match for a private address will not match traffic sent to a public address before or after NAT as you expect.
Use counters during a fresh connection
Counters reveal whether the packet reached a rule. Save the current state, initiate one new connection, and inspect counters again:
iptables -L -n -v --line-numbers
iptables -t nat -L -n -v --line-numbers
ip6tables -L -n -v --line-numbersOn a newly generated connection, the intended ACCEPT rule should increase if that rule sees the packet. If its counter remains unchanged, investigate the interface, address family, destination address, network namespace, port and chain before changing the rule. The packet may be using IPv6, arriving on a bridge, or entering FORWARD instead of INPUT.
If an earlier DROP or REJECT counter increases, rule order is decisive. iptables evaluates rules in chain order and applies a target such as ACCEPT, DROP or RETURN. A preceding drop, a jump into a user-defined chain, or the built-in chain policy can terminate the path before the later ACCEPT. Inspect every chain referenced by a jump, not only the line containing your intended rule.
Identify the correct packet path and chain
Traffic delivered to the host
Connections addressed to a local host normally traverse the INPUT path. An ACCEPT in INPUT can help only after the packet has been routed as local traffic and reached that hook. It cannot compensate for a missing listener or a route that sends the packet elsewhere.
Forwarded, bridged or container traffic
Traffic routed through the machine to a virtual machine, container or another network normally traverses FORWARD, with NAT hooks potentially changing the destination. Opening the host’s INPUT chain does not automatically permit a DNAT or container path. Check the forwarding policy, bridge interface, destination translation and the rules in the namespace that owns the service.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Network namespaces are independent. A service can listen inside a container namespace while the host’s ss output shows only the published or proxy socket, or no socket at all. Confirm where the process and interface exist, then inspect the corresponding namespace’s routes and firewall rules. For a published port, verify both directions: the host-to-container forwarding path and the container’s reply path.
Rank #4
Check firewalld ownership, zone and backend
When firewalld is installed, determine whether it owns the interface and rule set before editing direct iptables rules. Check its state and active zones:
firewall-cmd --state
firewall-cmd --get-active-zones
firewall-cmd --get-zone-of-interface=INTERFACE
firewall-cmd --list-allReplace INTERFACE with the actual device carrying the connection. A port opened in an inactive zone does not affect traffic arriving through another zone. Also distinguish runtime configuration from permanent configuration. A runtime change can work immediately and disappear after a reload or reboot unless it is saved permanently.
firewalld can use an nftables backend. In that arrangement, an ACCEPT inserted through an iptables compatibility command can still be subject to another nftables ruleset. For selective access, prefer the zone or rich-rule configuration managed by firewalld, then verify the generated effective rules with nft list ruleset. After saving a permanent change, reload deliberately and retest; a reload is also a useful way to expose rules that existed only at runtime.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Validate the route and return path
A permissive firewall cannot complete a connection if the server sends replies through the wrong interface or gateway. Inspect the route selected for the destination and source:
ip route show
ip route get DESTINATION from SOURCEReplace DESTINATION and SOURCE with the client and server addresses relevant to the failed connection. Confirm the selected interface, next hop and source address. Check policy-routing tables when multiple uplinks, VPNs or network namespaces are involved.
Best Value
Asymmetric routing is a common reason for a SYN to arrive while the SYN-ACK leaves through a different path and is discarded upstream. Cloud security groups, network ACLs, NAT mappings and perimeter firewalls can produce the same symptom as a local DROP. If available, capture traffic on the expected interface while making one fresh connection. Seeing the incoming SYN without a reply points toward the listener or local processing; seeing a reply leave but no handshake complete points toward the return route or an upstream filter.
Interpret what the client reports
| Client symptom | What it commonly indicates | Next checks |
|---|---|---|
| Immediate TCP reset | No listener, application refusal or an explicit reject | ss -lntup, service logs, rule counters and REJECT targets |
| Immediate ICMP port-unreachable | Usually no UDP listener or an explicit rejection | UDP socket, protocol match and reject rules |
| Silent timeout | DROP, upstream filtering, a wrong route or a broken return path | Counters, route lookup, interface capture and upstream policy |
| Works locally but not remotely | Bind scope, host firewall, forwarding, NAT or network ACL | Address binding, INPUT versus FORWARD, zones and both directions |
| Works until reload or reboot | Runtime rule was not persisted | firewalld permanent settings, saved rules and reload behavior |
In nftables, REJECT sends an ICMP or ICMPv6 unreachable response and defaults to a port-unreachable result. That makes an immediate error different from a silent DROP, although intermediate devices can alter or suppress responses.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCommon causes and the precise fix
| Root cause | Evidence | Corrective action |
|---|---|---|
| No process listening | No matching socket in ss; service log shows startup or bind failure |
Start or repair the service, then retest before editing firewall rules |
| Wrong bind address | Socket is on loopback, one private address or the wrong family | Configure the service to listen on the intended interface and address family |
| IPv4/IPv6 mismatch | Failed client uses AAAA or IPv4 while only the other family is configured | Add the matching listener and rules, or correct name resolution and client selection |
| Wrong chain or namespace | INPUT counters stay at zero; traffic arrives on a bridge or is routed onward | Inspect FORWARD, NAT and the service’s network namespace |
| Second ruleset drops | iptables rule counter rises but nftables or firewalld path drops later | Inspect nft list ruleset and manage access through the owning control plane |
| Rule order or default policy | Earlier DROP, user-chain jump or chain policy matches first | Trace the chain sequence and place a narrowly scoped allow before the decisive drop |
| Not persistent | Connection works until reload or reboot | Save permanent configuration and verify after an intentional reload |
| Routing or upstream filter | Incoming packet or local test succeeds, but reply path or remote route fails | Use ip route get, inspect NAT and network security policy, and capture both directions |
A repeatable troubleshooting procedure
- Record the exact endpoint. Write down protocol, port, destination address, source network and whether the client selected IPv4 or IPv6.
- Check listeners. Run
ss -lntupandss -lnup. Correct the service or bind address if no matching socket exists. - Test locally. Connect to the exact local and interface address. A local failure is not a firewall-remote problem yet.
- Test remotely. From another host, use the routable address and the same protocol. Compare the result with the local test.
- Dump all effective rules. Run
iptables -S,iptables -t nat -S,ip6tables -Sandnft list ruleset. - Watch counters. Clear or note counters, make one fresh connection, and identify the first rule whose counter changes. Follow jumps and chain policies.
- Trace the path. Decide whether the packet belongs in INPUT, FORWARD or a NAT path, and identify the interface and namespace it uses.
- Check firewalld. Verify active zone, backend, runtime versus permanent state and reload behavior before adding another direct rule.
- Verify routing. Run
ip route showandip route get DESTINATION from SOURCE; confirm the reply uses the expected interface and source address. - Capture if evidence conflicts. Observe the expected interface while making one connection so you can distinguish an absent packet, a local drop and a lost reply.
- Retest after persistence. Reload the responsible firewall service or reboot only after saving the intended configuration, then repeat the same local and remote tests.
Three diagnostic examples
TCP web service: local success, remote timeout
ss shows 127.0.0.1:8080, and local curl succeeds. The remote SYN never reaches an applicable listener because the service is loopback-only. Changing INPUT rules cannot expose it; change the service bind address, then permit the resulting interface path.
IPv6 client, IPv4-only rule
IPv4 testing succeeds, but a hostname test times out. The client selected an AAAA address. ip6tables -S has no corresponding allow rule and the service may have no IPv6 listener. Test with curl -4 and curl -6, then configure the intended family rather than assuming an IPv4 ACCEPT covers both.
Container port published through the host
The host’s INPUT rule counter does not change, while the service is reachable from inside the container. The connection is being forwarded through a bridge and possibly DNATed. Inspect FORWARD and NAT rules, bridge interfaces, container namespace policy and the return route; opening only host INPUT addresses the wrong hook.
Quick Recap
Before declaring the port open
- A process listens on the intended TCP or UDP port.
- The bind address covers the public, private or loopback endpoint being tested.
- The client and server use the same address family you configured.
- The packet reaches the expected interface, chain and namespace.
- The effective iptables, ip6tables, nftables and firewalld policies agree.
- Rule counters change on a fresh test and no later DROP or REJECT overrides the allow.
- The route and return path select the expected interface and source address.
- The configuration survives the required reload or reboot.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
